Method and apparatus for fault tolerant ethernet time synchronization

ABSTRACT

The present application generally relates to network timing synchronization in the presence of link faults including apparatus and methods In various embodiments, a method includes generating a time synchronization signal, transmitting the time synchronization signal from a first switch to a second switch via a first link and from the first switch to a third switch via a second link, detecting a link failure of the first link, and transmitting the time synchronization signal from the second switch to the third switch via a third link in response to the link failure.

INTRODUCTION

The subject of the disclosure relates generally to data distribution ina motor vehicle and more particularly, to a method and apparatus forproviding fault tolerant ethernet timing in a multiple time domainsystem in the presence of one or more hardware link failures.

Modern vehicle include many systems and subsystems for vehicle control,vehicle system monitoring and passenger comfort. As the level ofsophistication of vehicle subsystems increase, such as with thedeployment and performance of advanced driver-assistance systems (ADAS),the requirement for reliable subsystem to subsystem communications andmonitoring will increase. Communications between vehicle subsystems hasbeen employed to allow sensor data to be shared among vehicle subsystemsthereby reducing the occurrence of redundant duplicate sensors. Thiscommunication between vehicle subsystems has traditionally been handledby a controller area network (CAN) bus. A problem arises in that many ofthe vehicle subsystems have controllers and other components thatgenerate and employ their own timing structures and time domains makingcommunications among vehicle subsystems problematic. The CAN busrequires excessive clock and bit synchronization which greatly restrictsthe data rate of the CAN bus for advanced applications.

To address the data rate restriction of the Can bus, Ethernet is beingdeployed as a vehicle communications system as the vehicle controlsystems scale towards higher levels of automated driving, therebyincreasing the need for a fault-tolerant time synchronization method onthe Ethernet. The IEEE has defined a standard (802.1AS) for multipletime domains over Ethernet but does not define a protocol to achievefault tolerance in presence of link or hardware failures. It would bedesirable to provide a configuration with multiple time domains andalgorithms to retain a common time base without any time jumps inpresence of one or more hardware or link failures It would be desirableto address these problems and overcome the related restrictions in orderto address the timing issues presented by Ethernet protocol in a vehicleenvironment while overcoming the aforementioned problems.

SUMMARY

Disclosed herein are object detection methods and systems and relatedcontrol logic for provisioning vehicle sensing and control systems,methods for making and methods for operating such systems, and motorvehicles equipped with onboard sensor and control systems. By way ofexample, and not limitation, there is presented various embodiments ofnetwork timing configuration techniques are disclosed herein.

In one embodiment, a method for providing a fault tolerant network timesynchronization in a motor vehicle communications network includesgenerating a time synchronization signal, transmitting the timesynchronization signal from a first switch to a second switch via afirst link and from the first switch to a third switch via a secondlink, detecting a link failure of the first link, and transmitting thetime synchronization signal from the second switch to the third switchvia a third link in response to the link failure.

In accordance with various embodiments, the link failure is detected inresponse to the third switch not receiving the time synchronizationsignal via the second link.

In accordance with various embodiments, the link failure is detected inresponse to the third switch not receiving the time synchronizationsignal via the second link for a plurality of time synchronizationintervals.

In accordance with various embodiments, the second switch is operativeto enable a master port in response to the link failure.

In accordance with various embodiments, the third switch is operative tocouple the time synchronization signal from the second switch to an edgenode and wherein the edge node is operative to synchronize a clock inresponse to the time synchronization signal.

In accordance with various embodiments, the time synchronization signalis generated by an edge node designated as a grandmaster.

In accordance with various embodiments, the time synchronization signalis generated by a radar controller coupled to the first switch andwherein a first radar sensor is coupled to the second switch and asecond radar sensor is coupled to the third switch.

In accordance with various embodiments, a method operative to generate afollow-up frame having a timestamp for determining a latency among thefirst switch and the second switch.

In accordance with various embodiments, a fourth switch is operative toreceive the time synchronization signal from the third switch.

In accordance with another embodiment, an apparatus includes a firstnetwork node including a first switch for transmitting a first timesynchronization signal, a second network node including a second switchfor receiving the first time synchronization signal from the firstswitch and for transmitting a second time synchronization signal to thethird switch, and a third network node including the third switch forreceiving the first time synchronization signal from the first switchand the second time synchronization signal from the second switch, thethird node being further operative to synchronize an internal clock tothe first synchronization signal in response to receiving the first timesynchronization signal and to synchronize the internal clock to thesecond synchronization signal in response to not receiving the firsttime synchronization signal.

In accordance with various embodiments, the internal clock issynchronized to the second time synchronization signal in response to adetection of a link failure between the first switch and the thirdswitch.

In accordance with various embodiments, the internal clock issynchronized to the second time synchronization signal in response to adetection of a link failure between the first switch and the thirdswitch and wherein the link failure is determined in response to thethird switch not receiving the first time synchronization signal for aplurality of time synchronization intervals.

In accordance with various embodiments, the first network node isdesignated as a grandmaster.

In accordance with various embodiments, the third switch is operative toredefine a port role as a master port from a slave port in response tothe link failure.

In accordance with various embodiments including a fourth switch, thethird switch is operative to transmit the second time synchronizationsignal to the fourth switch in response to the link failure.

In accordance with various embodiments, the first network node is alidar controller the third network node is a lidar sensor.

In accordance with various embodiments, the second network node isoperative to initiate a master port in response to the link failure.

In accordance with various embodiments, the first node is operative togenerate a follow-up frame indicative of a first latency and the secondnode is operative to update the follow-up node in response to the firstlatency and a second latency.

In accordance with another embodiment, a vehicle network includes avehicle controller having a first network switch and a grandmaster clockwherein the vehicle controller is operative to generate a first timesynchronization frame in response to the grandmaster clock and to couplethe first time synchronization from the first network switch to a secondnetwork switch via a first data link and to couple the first timesynchronization from the first network switch to a third network switchvia a second data link, a first vehicle sensor having the second networkswitch configured for receiving the first time synchronization frame viathe first data link, for generating a second time synchronization framein response to the first time synchronization frame and for transmittingthe second time synchronization frame to the third network switch via athird data link, and a second vehicle sensor having the third networkswitch and an internal clock wherein the second vehicle sensor isoperative to synchronize the internal clock with the grandmaster clockaccording to the first time synchronization signal in response toreceiving the first time synchronization frame, the second vehiclesensor being further operative to synchronize the internal clock withthe grandmaster clock according to the second time synchronizationsignal in response to not receiving the first time synchronizationframe.

In accordance various embodiments, the second vehicle sensor isoperative to synchronize the internal clock with the grandmaster clockaccording to the second time synchronization signal in response to notreceiving the first time synchronization frame for a plurality of timesynchronization intervals.

The above advantage and other advantages and features of the presentdisclosure will be apparent from the following detailed description ofthe preferred embodiments when taken in connection with the accompanyingdrawings.

BRIEF DESCRIPTION OF THE DRAWINGS

The exemplary embodiments will hereinafter be described in conjunctionwith the following drawing figures, wherein like numerals denote likeelements, and wherein:

FIG. 1 illustrates an exemplary application of the method and apparatusfor fault tolerant ethernet time synchronization in a motor vehicleaccording to an embodiment of the present disclosure;

FIG. 2 shows a block diagram illustrating an exemplary system for faulttolerant Ethernet time synchronization in a motor vehicle according toan embodiment of the present disclosure;

FIG. 3 shows a flowchart illustrating an exemplary method for faulttolerant Ethernet time synchronization according to an embodiment of thepresent disclosure;

FIG. 4 shows a block diagram illustrating another exemplary system forfault tolerant Ethernet time synchronization in a motor vehicleaccording to an embodiment of the present disclosure;

FIG. 5 shows a flowchart illustrating another exemplary method for faulttolerant Ethernet time synchronization according to an embodiment of thepresent disclosure; and

The exemplifications set out herein illustrate preferred embodiments ofthe invention, and such exemplifications are not to be construed aslimiting the scope of the invention in any manner.

DETAILED DESCRIPTION

The following detailed description is merely exemplary in nature and isnot intended to limit the disclosure or the application and usesthereof. Furthermore, there is no intention to be bound by any theorypresented in the preceding introduction or the following detaileddescription. For example, the communication network and communicationnetwork protocol has particular application for use on a vehicle.However, as will be appreciated by those skilled in the art, the networkconfiguration and methods described herein may have other applicationsin systems outside of vehicles.

Turning now to FIG. 1 a diagram showing a system 100 for an exemplaryapplication of the method and apparatus for fault tolerant ethernet timesynchronization in a motor vehicle 105 according to an embodiment of thepresent disclosure. The exemplary system 100 includes a video controller115 coupled to a first camera 110 and a second camera 175, a lidarcontroller 125 coupled to a first lidar transceiver 130 and a secondlidar transceiver 120, a radar controller 145 coupled to a first radartransceiver 140 and a second radar 150, a processor 160, a userinterface 165, a vehicle controller 155 and a trailer interface 170.

In this exemplary embodiment, the lidar controller 125, video controller115, radar controller 145, are each operative to receive and processdata from their respective sensors. The video controller 115 isoperative to receive images from the first camera 110 and the secondcamera 175, to process the images to generate image data for use ingenerating an object map around the vehicle 105. The lidar controller125 may be operative to receive direction and distance data from each ofthe first lidar transceiver 130 and the second lidar transceiver 120.Likewise, the radar controller 145 may be operative to receive directionand distance data from each of the first radar transceiver 140 and thesecond radar 150. The image data, lidar data and radar data may becombined, using sensor fusion techniques or the like, to generate athree-dimensional object map of the area surrounding the vehicle 105.This three-dimensional map may then be coordinated with high definitionroad maps received via a wireless transmission and stored in a memory.

The processor 160 may use the three-dimensional object map, the highdefinition road maps, vehicle sensor data and user data received via theuser interface 165 as inputs into an ADAS algorithm, such as adaptivecruise control, lane centering operations, autonomous lane changes,obstacle avoidance or the like. In response to the ADAS algorithm, theprocessor 160 may then generate control signals to couple to the vehiclecontroller 155 in order to control the vehicle operation. For example,the vehicle controller 155 may generate steering control signals tocouple to a steering controller, throttle control signals to couple to athrottle controller, and brake control signals to couple to a brakingcontroller.

Timing is an important aspect for each controller 155 and the processor160 in order to coordinate data. For instance, radar, lidar and imagedata is not useful if it cannot be accurately provided to the processor160 in order to provide accurate control signals to the vehiclecontroller 155. Furthermore, in a vehicle environment, it is criticalthat this timing data and associated intersystem communications beaccurately communicated in the presence of system faults orcommunication channel failures. To address this problem, the exemplarysystem provides for a timing startup protocol to avoid time jumps byemploying an agreement protocol considering multiple time domains andmultiple failure conditions. This time synchronization in the presenceof faults enables fail operational applications relying on a globalnotion of time, such as level 4 autonomous vehicles.

In an exemplary embodiment, the system 100 is operative to employ acommunications bus 190 where each of the controllers are coupled to twoother controllers in a ring configuration. Data sent via the network maybe unidirectional or bidirectional. Use of multiple clock trees may beused to form multiple time domains. The exemplary startup protocol maybe used to select time domain in normal operating mode and in allfailure modes in order to guaranteed consistency among all endpoints inthe system, regardless of failure mode. In one exemplary embodiment, thestartup protocol may use for multiple Grand Masters while guaranteeingabsence of time jumps in case Grand Masters fail at runtime. The startupprotocol to switch among multiple clock trees (multiple time domains) inpresence of failures to guarantee absence of time jumps in failuremodes.

The system 100 is operative to provide a protocol to provide for timesynchronization for multiple systems in multiple time domains in anormal mode and in failure modes. In this example, an end node within afirst time domain may be chosen as a grandmaster for providing a roottiming reference to the first time domain. The end node having thegrandmaster is operative to periodically transmit synchronizationinformation to the clocks residing within the first time domain. The endnode having the grandmaster is further operative to transmit a follow-upframe which is used to keep track of the transit times by each node inthe network. Using the follow-up frame, a node can utilize the syncframe and the follow-up frame to sync with the grandmaster. In addition,systems with clocks within the first time domain may then relay accuratetime to the additional time domains to which they are also connected.The exemplary system can then guarantee consistency among all endpointsin the system, regardless of failure mode.

In the exemplary system 100, the video controller 115, lidar controller125, radar controller 145, processor 160 and vehicle controller 155 maybe configured to form a time domain. In normal mode, the processor 160may be chosen to have the grandmaster clock and may be operative totransmit sync packets to the other nodes in the time domain in responseto the grandmaster clock. In this example, the processor 160 has amaster port and the radar controller 145 has a slave port. The radarcontroller 145 transmits a time sync signal via a master port to a slaveport at the lidar controller 125, the lidar controller 125 transmits atime sync signal via a master port to a slave port at the videocontroller 115 which transmits a time sync signal via a master port to aslave port at the vehicle controller 155. Each node within the timedomain is operative to time sync with the sync frame received from itsrespective master port and to discard other time frames received.

In the event of a link failure, a node within the time domain may stopreceiving sync frames via its slave port from the designated node masterport. For example, if there is a link failure between the lidarcontroller 125 and the video controller 115, the video controller willstop receiving sync frames from the lidar controller 125. In addition,the video controller 115 will stop generating sync signals to betransmitted and therefore the vehicle controller 155 will stop receivingsync signals from the video controller 115. In response to not receivinga number of sync signals from a designated node, a node may determinethat a failure mode exists and resort to an alternate designated nodemaster port. In this example, the processor 160 would then becometransmit sync signals to the vehicle controller 155 and the vehiclecontroller 155 would transmit sync signals to the video controller 115.In the failure mode, the video controller 115 would then synchronize itsclock to the sync frame and follow-up frame received from the vehiclecontroller 155. Likewise, the vehicle controller 155 would synchronizeits clock to the sync frame and follow-up frame received from theprocessor 160.

In this exemplary time domain, each node would only require onealternate node for receiving time sync signals when a failure mode isdetected. For example in the exemplary time domain, the lidar controller125 would synchronize with a sync frame from the radar controller 145unless there was a link failure between the processor 160 and the radarcontroller 145 or between the radar controller 145 and the lidarcontroller 125. In the instance of any other link failure, the lidarcontroller 125 would still receive a sync frame from the radarcontroller 145. If the lidar controller 125 stopped receiving syncframes from the radar controller 145, the lidar controller 125 wouldthen switch to the video controller 155 as a master.

Turning now to FIG. 2, a block diagram depicting an exemplary system 200for fault tolerant Ethernet time synchronization in a motor vehicle isshown. In this exemplary embodiment, the system 200 may include anEthernet protocol network configured in a ring configuration. Theexemplary network may include switches S1 220, S2 240, S3 260, S4 270,and edge nodes or end points E1 210, E2 230, E3 250, E4 280. In someconfigurations, a switch S1 220, S2 240, S3 260, S4 270 may beintegrated with an edge node E1 210, E2 230, E3 250, E4 280. Forexample, a lidar sensor may be an edge node in the network with anintegrated switch. During normal operation, E1 210 may be designated asa grandmaster clock and S1 220 is a slave to E1 210. S1 220 is then amaster to both S2 240 and S3 260 with E2 230 being a slave to S2 240 andE3 250 being a slave to S3 260. In this exemplary embodiment, S4 270 isthen a slave to S2 240 and the link between S3 260 and S5 is disabledfor clock synchronization purposes.

A link fault may be detected in response to an edge node not receivingan anticipated sync packet from master node. For example, should a linkfault occur between S1 220 and S3 260, E3 250 will no longer receivesync packets from E1 210. E3 250 would then switch to an alternateconfiguration, or domain, in that S4 270 would then become the alternatemaster to S3 260 and E2 230 would being to receive sync packets from E4280. In the occurrence of a link fault between S1 220 and S3 260, S3 260becomes a slave to S4 270 with the link between S1 220 and S3 260 beingdisabled. Likewise, in the occurrence of a link failure between S1 220and S2 240, S4 270 becomes a slave to S3 260 and S2 240 becomes a slaveto S4 270 with the link between S1 220 and S2 240 being disabled. Shouldthere be an occurrence of a link failure between S2 240 and S4 270, S3260 becomes a master to S4 270 with S1 220 being a master to both S2 240and S3 260 and the link between S2 240 and S4 270 is disabled. For eachpossible link fault, nodes not receiving sync packets would switch to analternate master node.

To accommodate for a link failure that would isolate the designatedgrandmaster node or a runtime failure of a grandmaster, a startupprotocol for multiple grandmasters is provided for guaranteeing absenceof time jumps. To avoid these problems, a secondary grandmaster isdesignated for each time domain. Upon startup, the secondary grandmasterinitiates its own clock. The secondary grandmaster is the operative toattempt to receive the sync frame from the primary grandmaster via thenormal master node. If the sync frame is not received via the normalmaster node, the secondary grandmaster is operative to attempt toreceive the sync frame from the alternate master node. If the sync frameis not received within a predetermined period of time from the alternatemaster node, the second grandmaster is then operative to generate andtransmit a sync packet in response to its own clock as the primarygrandmaster. If a sync frame is received from the grandmaster uponstartup, the secondary grandmaster is operative to sync its own clock tothat of the grandmaster. If at a later time, there is a link failure andsync packets are no longer received from the grandmaster via the normalmaster node or the alternate master node, the secondary grandmastergenerates a sync frame from its own previously synchronized clock and totransmit this sync frame via the time domain network. This startupprotocol guarantees an absence of time jumps in failure modes as thesecondary grandmaster clock is synchronized to the primary grandmaster.

Turning now to FIG. 3, a flowchart illustrating an exemplary method 300for fault tolerant ethernet time synchronization in a motor vehicle isshown. In this exemplary embodiment an edge node is operative to performthe exemplary method 300. The exemplary method 300 is first operative toinitialize 310 an internal clock. After initialization of the internalclock, the method is next operative to operate with a timing accordingto the internal clock at 320. For example, the exemplary edge node maybe a radar controller operative to perform a vehicular radar algorithm.The radar controller may be further operative to cascade its internalclock via a sync signal to radar sensors thereby forming another timedomain with the radar sensors.

The method is next operative to determine at 330 if a sync signal hasbeen received from a primary grandmaster node. If the sync signal hasbeen received from the primary grandmaster node, the method 300 is nextoperative to sync the internal clock at 340 and return to operating withthe internal clock at 320. If the sync signal has not been received fromthe primary grandmaster node for a predetermined number of clock cycles,such as eight clock cycles, the method 300 is then operative todetermine at 350 if a sync signal has been received at a switchingportion of the edge node from an alternate master. If the sync signalhas been received from the alternate master at 350, the method 300 isthen operative to sync at 340 the internal clock to the sync signal fromthe alternate master and to return to operating at 320 with the internalclock. In one exemplary embodiment, the alternate master may become theprimary master with the previous primary master becoming the alternatemaster depending on design criteria. Alternatively, the alternateprimary may remain the alternate primary and the edge node continues tofirst check for sync signals from the primary master before syncing to async signal from the alternate master.

If no sync signal is received from the alternate master a t350, themethod 300 is next operative to determine if the current edge noderunning the method has been designated as an alternate grandmaster at360. If the current edge node has not been designated as an alternategrandmaster at 360, the method 300 may then operative to generate at 380an error signal indicative of a synchronization loss and couple thiserror signal to a system controller, vehicle controller or othersupervisory controller. The method may then return to operating at 320with the current clock. Alternatively, the current node may shutdown390, go into a standby state, or into an alternate operating state inresponse to a synchronization loss.

If the current node is determined to be an alternate grandmaster at 360,the method 300 is then operative to generate and transmit 370 a syncsignal via the ethernet network to the other nodes. The method mayfurther generate a follow-up frame indicative of accumulated propagationdelays or the like. After transmission 370 of the sync signal, themethod may then return to operating 320 with the current clock.

Turning now to FIG. 4, a block diagram illustrating an exemplary system400 for fault tolerant ethernet time synchronization in a motor vehiclenetwork is shown. The exemplary system 400 may include a first networknode 410 and a first switch 415, a second network node 420 and a secondswitch 425, and a third network node 430 and a third switch 435. Thefirst network switch may be coupled to the second network switch by afirst link 475. The first network switch 415 may be coupled to a thirdnetwork switch by a second link 480. In The second network switch 425may be coupled to the third network switch 435 by a third link 485.

In the exemplary embodiment, the first network node 410, coupled to afirst switch 415, is configured for generating and transmitting a firsttime synchronization signal in response to a first clock internal to thefirst network node 410. The first switch 415 may be integral to thefirst network node and is configured to transmit data on an Ethernetnetwork via a master port and to receive data from the Ethernet networkvia a slave port. These ports are configurable and may be switched frommaster to slave or slave to master in response to a network linkfailure, control signal from the first network node 410, or the like. Inone exemplary embodiment, the first clock may be designated asgrandmaster clock to be used as a timing reference for all nodes withthe time domain of the Ethernet network. The first network node 410 maybe further configured to generate a follow-up frame indicative of afirst latency resulting from processing of the first timesynchronization signal by the first switch 415 and the second networknode 420 is operative to update the follow-up node in response to thefirst latency and a second latency resulting from processing of thefirst time synchronization signal by the second switch 425.

The second network node 420 including the second switch 425 may beconfigured for receiving the first time synchronization signal from thefirst switch 415 and for transmitting a second time synchronizationsignal to the third switch 435. In one exemplary application, the firstnetwork node 410 may be a lidar controller the second network node 420may be a lidar sensor. In response to a network link failure, the secondnetwork node 420 may initiate a master port in response to the linkfailure.

In this exemplary embodiment, the third network node 430 including thethird switch 435 is configured for receiving the first timesynchronization signal from the first switch 415 and the second timesynchronization signal from the second switch 425. The third networknode 430 may be further operative to synchronize a third node internalclock to the first synchronization signal in response to receiving thefirst time synchronization signal from the first switch 415 via thesecond link 480. The third network node 430 may be further operative tosynchronize the internal clock to the second synchronization signal inresponse to not receiving the first time synchronization signal from thefirst switch 415 via the second link 480. In one exemplary embodiment,the internal clock may be synchronized to the second timesynchronization signal in response to a detection of a link failurebetween the first switch 415 and the third switch 435 wherein the linkfailure is determined in response to the third switch 435 not receivingthe first time synchronization signal for a plurality of timesynchronization intervals. In one exemplary application, the thirdswitch 435 may be operative to redefine a port role as a master portfrom a slave port in response to the link failure. The exemplary systemmay further include a fourth switch where the third switch 435 may beoperative to transmit the second time synchronization signal to thefourth switch in response to the link failure.

In an exemplary embodiment, the exemplary system 400 may be a vehiclecommunications network including a vehicle controller having a firstnetwork switch and a grandmaster clock wherein the vehicle controller isoperative to generate a first time synchronization frame in response tothe grandmaster clock and to couple the first time synchronization fromthe first network switch to a second network switch via a first datalink and to couple the first time synchronization from the first networkswitch to a third network switch via a second data link. The exemplarysystem 400 further includes a first vehicle sensor having the secondnetwork switch configured for receiving the first time synchronizationframe via the first data link configured for generating a second timesynchronization frame in response to the first time synchronizationframe and for transmitting the second time synchronization frame to thethird network switch via a third data link. The exemplary system 400further includes a second vehicle sensor having the third network switchand an internal clock wherein the second vehicle sensor is operative tosynchronize the internal clock with the grandmaster clock according tothe first time synchronization signal in response to receiving the firsttime synchronization frame, to synchronize the internal clock with thegrandmaster clock according to the second time synchronization signal inresponse to not receiving the first time synchronization frame. Inaddition, the second vehicle sensor may be configured to synchronize theinternal clock with the grandmaster clock according to the second timesynchronization signal in response to not receiving the first timesynchronization frame for a plurality of time synchronization intervals.

Turning now to FIG. 5, a block diagram illustrating an exemplary method500 for fault tolerant ethernet time synchronization during grand masterfailure in a motor vehicle is shown. The exemplary method is firstoperative for generating 510 a time synchronization signal forsynchronizing multiple nodes in a multiple time domain networkconfiguration. The time synchronization signal may be generated by anedge node designated as a grandmaster. For example, the timesynchronization signal may generated by a radar controller coupled to afirst radar sensor and a second radar sensor. In one exemplaryembodiment, each of the radar sensors may be an edge node with anintegrated switch node having at least one port configured in a slavemode. The method may be further operative to generate a follow-up framehaving a timestamp for determining a latency accumulated duringpropagation through one or more switch nodes and an end node.

The method may the transmit 520 the time synchronization signal from afirst switch to a second switch via a first link and from the firstswitch to a third switch via a second link. In one exemplary embodiment,there may be a third link between the second switch and the third switchwhich is disabled for network synchronization purposes.

The method is next operative for detecting 530 a link failure of thesecond link, the link failure is detected in response to the thirdswitch not receiving the time synchronization signal via the secondlink. In one exemplary embodiment, the link failure may be detected inresponse to the third switch not receiving the time synchronizationsignal via the second link for a plurality of time synchronizationintervals.

In response to detecting the link failure, the method 500 is thenconfigured for transmitting 540 the time synchronization signal from thesecond switch to the third switch via a third link. The second switchmay enable a master port in response to the link failure wherein theport had previously been configured as a slave port. The third switchmay receive the time synchronization signal from the second switch andthen couple the time synchronization signal to an edge node. Inresponse, the edge node may synchronize an internal clock in response tothe time synchronization signal. In addition, the exemplary system mayinclude a fourth switch operative to receive the time synchronizationsignal from the third switch. In this exemplary embodiment, the thirdswitch may enable a master port to transmit the time synchronizationsignal to the fourth switch.

It should be emphasized that many variations and modifications may bemade to the herein-described embodiments, the elements of which are tobe understood as being among other acceptable examples. All suchmodifications and variations are intended to be included herein withinthe scope of this disclosure and protected by the following claims.Moreover, any of the steps described herein can be performedsimultaneously or in an order different from the steps as orderedherein. Moreover, as should be apparent, the features and attributes ofthe specific embodiments disclosed herein may be combined in differentways to form additional embodiments, all of which fall within the scopeof the present disclosure.

Conditional language used herein, such as, among others, “can,” “could,”“might,” “may,” “e.g.,” and the like, unless specifically statedotherwise, or otherwise understood within the context as used, isgenerally intended to convey that certain embodiments include, whileother embodiments do not include, certain features, elements and/orstates. Thus, such conditional language is not generally intended toimply that features, elements and/or states are in any way required forone or more embodiments or that one or more embodiments necessarilyinclude logic for deciding, with or without author input or prompting,whether these features, elements and/or states are included or are to beperformed in any particular embodiment.

Moreover, the following terminology may have been used herein. Thesingular forms “a,” “an,” and “the” include plural referents unless thecontext clearly dictates otherwise. Thus, for example, reference to anitem includes reference to one or more items. The term “ones” refers toone, two, or more, and generally applies to the selection of some or allof a quantity. The term “plurality” refers to two or more of an item.The term “about” or “approximately” means that quantities, dimensions,sizes, formulations, parameters, shapes and other characteristics neednot be exact, but may be approximated and/or larger or smaller, asdesired, reflecting acceptable tolerances, conversion factors, roundingoff, measurement error and the like and other factors known to those ofskill in the art. The term “substantially” means that the recitedcharacteristic, parameter, or value need not be achieved exactly, butthat deviations or variations, including for example, tolerances,measurement error, measurement accuracy limitations and other factorsknown to those of skill in the art, may occur in amounts that do notpreclude the effect the characteristic was intended to provide.

The processes, methods, or algorithms disclosed herein can bedeliverable to/implemented by a processing device, controller, orcomputer, which can include any existing programmable electronic controlunit or dedicated electronic control unit. Similarly, the processes,methods, or algorithms can be stored as data and instructions executableby a controller or computer in many forms including, but not limited to,information permanently stored on non-writable storage media such as ROMdevices and information alterably stored on writeable storage media suchas floppy disks, magnetic tapes, CDs, RAM devices, and other magneticand optical media. The processes, methods, or algorithms can also beimplemented in a software executable object. Alternatively, theprocesses, methods, or algorithms can be embodied in whole or in partusing suitable hardware components, such as Application SpecificIntegrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs),state machines, controllers or other hardware components or devices, ora combination of hardware, software and firmware components. Suchexample devices may be on-board as part of a vehicle computing system orbe located off-board and conduct remote communication with devices onone or more vehicles.

While exemplary embodiments are described above, it is not intended thatthese embodiments describe all possible forms encompassed by the claims.The words used in the specification are words of description rather thanlimitation, and it is understood that various changes can be madewithout departing from the spirit and scope of the disclosure. Aspreviously described, the features of various embodiments can becombined to form further exemplary aspects of the present disclosurethat may not be explicitly described or illustrated. While variousembodiments could have been described as providing advantages or beingpreferred over other embodiments or prior art implementations withrespect to one or more desired characteristics, those of ordinary skillin the art recognize that one or more features or characteristics can becompromised to achieve desired overall system attributes, which dependon the specific application and implementation. These attributes caninclude, but are not limited to cost, strength, durability, life cyclecost, marketability, appearance, packaging, size, serviceability,weight, manufacturability, ease of assembly, etc. As such, embodimentsdescribed as less desirable than other embodiments or prior artimplementations with respect to one or more characteristics are notoutside the scope of the disclosure and can be desirable for particularapplications.

What is claimed is:
 1. A method for providing a fault tolerant networktime synchronization in a motor vehicle communications networkcomprising: generating a time synchronization signal; transmitting thetime synchronization signal from a first switch to a second switch via afirst link and from the first switch to a third switch via a secondlink; detecting a link failure of the second link; and transmitting thetime synchronization signal from the second switch to the third switchvia a third link in response to the link failure.
 2. The method of claim1 wherein the link failure is detected in response to the third switchnot receiving the time synchronization signal via the second link. 3.The method of claim 2 wherein the link failure is detected in responseto the third switch not receiving the time synchronization signal viathe second link for a plurality of time synchronization intervals. 4.The method of claim 1 wherein the second switch is operative to enable amaster port in response to the link failure.
 5. The method of claim 1wherein the third switch is operative to couple the time synchronizationsignal from the second switch to an edge node and wherein the edge nodeis operative to synchronize a clock in response to the timesynchronization signal.
 6. The method of claim 1 wherein the timesynchronization signal is generated by an edge node designated as agrandmaster.
 7. The method of claim 1 wherein the time synchronizationsignal is generated by a radar controller coupled to the first switchand wherein a first radar sensor is coupled to the second switch and asecond radar sensor is coupled to the third switch.
 8. The method ofclaim 1 further operative to generate a follow-up frame having atimestamp for determining a latency among the first switch and thesecond switch.
 9. The method of claim 1 further including a fourthswitch operative to receive the time synchronization signal from thethird switch.
 10. An apparatus comprising: a first network nodeincluding a first switch for transmitting a first time synchronizationsignal; a second network node including a second switch for receivingthe first time synchronization signal from the first switch and fortransmitting a second time synchronization signal to the third switch;and a third network node including a third switch for receiving thefirst time synchronization signal from the first switch and the secondtime synchronization signal from the second switch, the third node beingfurther operative to synchronize an internal clock to the firstsynchronization signal in response to receiving the first timesynchronization signal and to synchronize the internal clock to thesecond synchronization signal in response to not receiving the firsttime synchronization signal.
 11. The apparatus of claim 10 wherein theinternal clock is synchronized to the second time synchronization signalin response to a detection of a link failure between the first switchand the third switch.
 12. The apparatus of claim 11 wherein the internalclock is synchronized to the second time synchronization signal inresponse to a detection of a link failure between the first switch andthe third switch and wherein the link failure is determined in responseto the third switch not receiving the first time synchronization signalfor a plurality of time synchronization intervals.
 13. The apparatus ofclaim 10 the first network node is designated as a grandmaster.
 14. Theapparatus of claim 10 wherein the third switch is operative to redefinea port role as a master port from a slave port in response to notreceiving the first time synchronization signal.
 15. The apparatus ofclaim 10 further including a fourth switch and wherein the third switchis operative to transmit the second time synchronization signal to thefourth switch in response to not receiving the first timesynchronization signal.
 16. The apparatus of claim 10 wherein the firstnetwork node is a lidar controller the third network node is a lidarsensor.
 17. The apparatus of claim 10 wherein the second network node isoperative to initiate a master port in response to not receiving thefirst time synchronization signal.
 18. The apparatus of claim 10 whereinthe first node is operative to generate a follow-up frame indicative ofa first latency and the second node is operative to update the follow-upnode in response to the first latency and a second latency.
 19. Avehicle network comprising; a vehicle controller having a first networkswitch and a grandmaster clock wherein the vehicle controller isoperative to generate a first time synchronization frame in response tothe grandmaster clock and to couple the first time synchronization fromthe first network switch to a second network switch via a first datalink and to couple the first time synchronization from the first networkswitch to a third network switch via a second data link; a first vehiclesensor having the second network switch configured for receiving thefirst time synchronization frame via the first data link, for generatinga second time synchronization frame in response to the first timesynchronization frame and for transmitting the second timesynchronization frame to the third network switch via a third data link;and a second vehicle sensor having the third network switch and aninternal clock wherein the second vehicle sensor is operative tosynchronize the internal clock with the grandmaster clock according tothe first time synchronization signal in response to receiving the firsttime synchronization frame, the second vehicle sensor being furtheroperative to synchronize the internal clock with the grandmaster clockaccording to the second time synchronization signal in response to notreceiving the first time synchronization frame.
 20. The vehicle networkof claim 19 wherein the second vehicle sensor is operative tosynchronize the internal clock with the grandmaster clock according tothe second time synchronization signal in response to not receiving thefirst time synchronization frame for a plurality of time synchronizationintervals.